MCP Distribution
Official DebugBundle MCP package, registry, marketplace, and skill distribution channels.
The official DebugBundle MCP server is the local stdio package @debugbundle/mcp, registered as com.debugbundle/mcp in the official MCP Registry.
Use this page to verify that a listing is legitimate before installing it into an agent environment.
Official Channels
| Channel | Status | URL |
|---|---|---|
| npm package | Published | @debugbundle/mcp |
| Official MCP Registry | Published and verified | com.debugbundle/mcp |
| MCP metadata | Source of truth | apps/mcp/server.json |
| Source repository | Source of truth | debugbundle/debugbundle |
| Docs | Source of truth | debugbundle.com/docs/mcp |
| Tool schema | Generated reference | schemas/mcp-tools.json |
| Agent index | Generated discovery file | llms.txt |
| Security reporting | Disclosure path | GitHub Security Policy |
The canonical install command is:
npx @debugbundle/mcpUse npx -y @debugbundle/mcp in clients that require noninteractive package execution.
Marketplace Listings
These downstream listings are discovery surfaces. The official MCP Registry and npm package remain the canonical install sources.
| Directory | Current State |
|---|---|
| Glama | Listed |
| PulseMCP | Auto-listed as official from registry metadata; manually browser-verified on 2026-06-25 |
| MCP.so | Listed |
| Smithery MCP | Release accepted, public indexing pending |
| LobeHub MCP | Submitted as a request, not yet confirmed listed |
Do not treat a downstream listing as official just because it is searchable. Confirm it points to com.debugbundle/mcp, @debugbundle/mcp, and the debugbundle/debugbundle repository.
Skill And Plugin Channels
DebugBundle also publishes agent instruction and OpenClaw package surfaces:
| Channel | Status |
|---|---|
| Smithery Skill | Published and indexed |
| ClawHub Skill | Published |
| ClawHub OpenClaw plugin | Published as @debugbundle/openclaw-plugin |
The portable skill teaches general DebugBundle workflows. A repository-local skill generated by debugbundle setup contains project-specific paths and should take precedence when present.
Trust Checks
Before adding DebugBundle MCP to a managed client or marketplace profile, verify:
- Package name is
@debugbundle/mcp. - Official MCP Registry name is
com.debugbundle/mcp. - The source repository is
https://github.com/debugbundle/debugbundle. - The server uses stdio transport unless a future hosted Remote MCP connector is explicitly documented.
- Examples use
DEBUGBUNDLE_MEMBER_TOKENor local CLI auth state for MCP operations. - Examples do not use project tokens for incident retrieval, bundle access, billing, project management, or other MCP management workflows.
- Examples do not contain real member tokens, project tokens, webhook secrets, customer hostnames, or customer bundle data.
Report suspicious listings, leaked examples, or security concerns through the DebugBundle security policy.
Auth Scope
MCP retrieval and management tools use member credentials:
| Credential | Use |
|---|---|
| CLI auth state | Local developer and local agent workflows |
DEBUGBUNDLE_MEMBER_TOKEN | Headless, CI, and marketplace-managed clients |
Per-tool bearerToken | Explicit advanced automation |
Project tokens are SDK write-only ingestion credentials. They are not valid for MCP management or retrieval.
Remote MCP Status
DebugBundle does not currently publish a hosted Remote MCP connector. The supported public MCP path is the local stdio package.
A hosted Remote MCP connector is a separate product slice because it requires hosted transport, member auth or OAuth, tenant authorization, rate limits, audit behavior, logging, readiness checks, and marketplace-specific connector documentation. The low-overhead launch shape, if prioritized, is https://mcp.debugbundle.com with member-token auth first, hosted-safe tools only, and no database changes unless persistent connector grants or OAuth state require a migration.
Until that ships, remote-agent environments should run the stdio package in their managed runtime and pass a member token through that runtime's secret mechanism.